Reddit suffered a cyberattack on February 5 during which hackers accessed some documents, code, and business systems; the company says users' passwords are safe
Reddit suffered a cyberattack Sunday evening, allowing hackers to access internal business systems and steal internal documents and source code.
Context & Ripple Effects
Reddit had already disclosed an earlier compromise in which employee work accounts were taken over through SMS-based two-factor interception, exposing some systems and user data. The February intrusion again reaches internal systems, but Reddit says passwords were not affected.
The incident's significance widened when BlackCat later tied its threatened publication of alleged Reddit data to the February 5 breach, turning an internal-security disclosure into a potential data-exposure and extortion issue.
First-order effects
- Reddit must assess and contain access to the affected documents, source code, and business systems while reassuring users that account passwords were not compromised.
- The attackers' access to source code and internal documents gives them material that BlackCat later claimed it could use to pressure Reddit through a threatened data release.
Second-order effects
- Reddit's employees and security teams face greater pressure to harden the work-account and internal-system access paths implicated across the 2018 and February incidents.
- A threatened release of material from the breach raises the stakes for Reddit's business counterparts whose information may be present in internal documents, even without a reported password compromise.
Third-order effects
- Repeated compromises involving employee access and internal systems point toward security governance at large online platforms being judged not only by user credential protection, but by the containment of code and business data.
- If extortion groups can convert internal access into public-release leverage, breach response increasingly centers on limiting what attackers can retain after initial access, not solely restoring affected systems.
The trend: Cyberattacks on online platforms are increasingly measured by attackers' access to internal code and business data, alongside the immediate risk to user accounts.